Knowledge Center

Having proper Multi-factor Authentication (MFA) protocols in place does not eliminate the need for insurance but it can lessen the cost and loss potential dramatically. With ransomware attacks and business email compromise scams making headlines and impacting companies of every size, organizations need to be proactive in protecting their cybersecurity posture and preparing for their cyber insurance renewal.

At Graham, we are committed to helping our clients implement mitigation measures to prevent catastrophic ransomware attacks and ensure coverage availability given the significant uptick in these claims over the last year and a half. It is becoming universally acknowledged that MFA measures are necessary to safeguard every level of security and privacy for small, mid-sized and large corporations. While cyber attacks are undoubtedly multiplying and the threat actors are growing more brazen because of their hacking successes and financial gain, there are ways to stop them in their tracks with proactivity, teamwork and ultimately, compliance.

MFA involves a two-pronged approach to access which includes a minimum of two verification factors beyond a username and password. Examples such as a one-time password (OTP) sent to your known device, fingerprint ID or voice recognition are common. Adaptive Authentication is a subset of MFA, also known as “Risk-Based Authentication” which analyzes other factors considering context and behavior (if you normally do not log in to your account from a coffee shop after hours, the system would flag that activity and look for ways for you to prove your identity that are not used when your IP address is connected to your place of business). In the case of the Colonial Pipeline cyber incident, just one password was needed for the threat actors to compromise the entire company’s IT infrastructure. In a high-profile and wide-ranging destructive example such as the Colonial Pipeline making headlines, there are fundamental lessons to be learned to help prevent these attacks from occurring.

The Colonial Pipeline and JBS ransomware attacks are in the news but some observers are projecting as many as 100,000 businesses of all shapes and sizes falling victim to this recently amped-up cyber threat in 2021. In the larger and more newsworthy cases, we are beginning to see government intervention. Agencies like Homeland Security and the FBI can be summoned to investigate and in particular they will try and determine if a cyber attack on an agency or company can be classified as terroristic. Additionally, the U.S. Department of the Treasury can use The Office of Foreign Assets Control (“OFAC”) sanctions to punish foreign bad actors deemed responsible for these attacks, and organizations and make payments to sanctioned countries and entities. It is important that when an organization is working through a cyber incident, they are engaging experienced vendors to assist in notifying the government and complying with advisories regarding ransom payments. Government agencies can then better track the threat actors, hopefully at their source, and recognize patterns. It sounds simple, but it’s not always done.

Some companies may find the extra steps of adding a layer of protection an undue burden on their IT departments. There can also be resistance from employees themselves who may see this as a time-waster and a barrier to their individual productivity. The truth is, these steps, if implemented properly and with help from knowledgeable sources, can be quickly executed while providing a great deal of protection. These measures can slow or even prevent a network compromise but are often perceived to be overkill by the people who must use them. A good IT department will simplify any difficulties with the set-up process and point out that an underestimated risk can wreak havoc. “It can’t happen here” until it does.

The proliferation of attacks and subsequent claims has, of course, led to an increase in premiums for policyholders across all industry segments. In February of this year, some estimates projected increases anywhere from 20 to 30%. As we approach the Summer, policy premium increases have approached something closer to 50%. This has to do with both the increase of reported cyber infiltrations for security damage inflicted on a company as well as the increased costs associated with ransom demands that have been paid. One way to help bring down these costs is to have full implementation of MFA protocols (for email access, remote access, and administrative controls) to prevent attacks or slow attempted ones before too much damage is done. Graham Company recommends MFA implementation for all organizations, as an additional layer of protection, in addition to a cyber insurance policy.

Having proper MFA protocols in place does not eliminate the need for insurance but it can lessen the cost and loss potential dramatically.

Please reach out to your Graham Company Service Team with any questions or for assistance in making your cyber hygiene more efficient and complete.

With 60 years of experience providing construction insurance and comprehensive safety counsel, we’re proud to have developed risk management solutions for some of the largest, most complex projects in the country – and in our own backyard. Recently, we had the opportunity to bring together over 50 construction leaders in the Philadelphia region for an Executive Leadership Summit held at the Brandywine Realty Trust headquarters in the FMC Tower at 29^th and Walnut Streets. Our Summit was an interactive discussion that reflected a shared pursuit of excellence in the industry.

A morning of insightful discussion helped us identify trending themes in today’s construction landscape:

Partnership and collaboration drive efficiency.

Kevin Mahoney, CEO, University of Pennsylvania Health System, and Jerry Sweeney, president and CEO, Brandywine Realty Trust, agreed that partnership and collaboration among all stakeholders – from owners to general contractors and subcontractors – creates an environment in which everyone involved is motivated to produce the best results at an efficient cost. For Sweeney, this approach allows the construction project to form a “great symphony,” with every disparate part coming together to create something amazing.

In many “traditional” construction projects, each party works – to a degree – in separate silos. And if the project suffers from a design defect or other error/omission of a professional nature, the project owner, architect, engineer and contractor may be forced to “point fingers” in order to get the issue resolved – sometimes to the point of litigation. This can tie up significant resources and prevent the project from meeting key budgets and timelines. This also potentially leads to “friction” on the jobsite, which can further exacerbate the issues and get the job off the rails.

No local project has demonstrated a solution to this concept better than Penn Medicine’s new 16-story, $1.5 billion Pavilion at the Hospital of the University of Pennsylvania (Pavilion), one of the most high-profile construction projects in Philadelphia today. We’ve had the privilege to work with Penn Medicine and its key design, architecture, engineering and construction management partners (collectively the PennFIRST team) to collaborate and develop comprehensive and cost-effective programs that set the project up for success under a truly unique method of construction called Integrated Project Delivery (IPD).

Ben Evans, associate vice president for risk management and insurance at the University of Pennsylvania, moderated our discussion at the summit. For him, the IPD philosophy is what brings the 10,000 puzzle pieces of a construction project together to create a complete picture. He’s hopeful that the principles behind Penn Medicine’s Pavilion project will follow contractors and their employees to their next jobsite and produce a ripple effect that will change the culture of construction in Philadelphia.

Culture makes the difference.

Regardless of the business competition among those attending the Executive Leadership Summit, one thing they can all agree on is the significance of creating a strong safety culture within their companies and projects. We were privileged to hear this message reiterated by many of our presenters, including Mack Stulb, president of LF Driscoll; Bob Herbein, executive vice president of Allan Myers; Jim Dolente, Jr., president of Madison Concrete Construction; Craig Melograno, president of Philadelphia D&M; and Don Swasing, chief operating officer of Schlouch, Inc. These construction leaders represent companies that are recognized as “best in class” with strong safety cultures.

Prioritizing safety too often comes after a “pivotal moment” – typically a serious injury or a tragic fatality – that serves as a wake-up call for leaders at the company. An incident like this spurs the management team to make safety a core value – but our panelists urged construction leaders not to wait until an incident happens to build safety into every aspect of the project.

Establishing a company culture centered on safety is the key, starting with the actions of senior management and field leaders. Field leaders need to be able to adapt to changing situations daily without compromising safety. From that point, safety must be ingrained into operations – like automatically putting on your seatbelt when you get in a car. It’s critically important that ownership and management teams authentically convey to employees that their safety is imperative to the success of the project and the organization.

Another growing trend improving safety in the construction industry is the implementation of modular construction and prefabrication. Using these concepts, contractors and subcontractors can build major portions of a project in a controlled environment. When you take factors like weather or a crowded job site out of the equation, the benefits of this approach are exponential in terms of minimizing risk and increasing quality. To expand the application of modular construction, safety must be part of the conversation starting in every planning stage of the project.

At Graham Company, we believe nothing is more important for our clients in the construction industry than creating a genuine culture of safety among all employees. This not only keeps employees safe while they’re on a jobsite, but helps organizations reduce risk exposures and improve their bottom lines.

Thank you to all who participated in the Executive Leadership Summit. We are fortunate to be a part of a construction community pushing the boundaries of what is possible – in innovation, efficiency, quality, profitability, and, most importantly, operational and personal safety.

Partnership builds success. Safety brings us home.

Jeffrey A. Spatz, CSP, CRIS, CET, CHST,

Vice President

[email protected]

The Graham Building
Philadelphia, PA, 19102

215-701-5454